Flue release readiness and final safety pass

[ZIJ]

Why

Final pre-merge review delta for the long-lived Flue evergreen. This closes the npm publication gap, removes one premature public API, and folds in the bounded correctness/security fixes found while testing the release artifact.

What changed

• Add an idempotent Node 22.19 publish workflow for @opencomputer/flue@0.2.0, using the existing npm secret, exact-version lookup, tests, a clean build, provenance, and public access.
• Add a reproducible SDK lockfile, Apache-2.0 package metadata/license, clean builds, and exclude test files from the tarball.
• Remove ocRepoTools / OcRepoEnv and their dependencies: W10 repo checkout/publish is explicitly unbuilt and should not be a 0.2.0 API promise.
• Preserve valid compatibility-date/flag and same-script Durable Object naming changes emitted by future Flue builds, while still rejecting unsafe paths, extra Wrangler capabilities, foreign-script bindings, invalid/duplicate flags, duplicate bindings, and empty DO builds.
• Strip URL credentials, query strings, and fragments before request URLs reach Axiom.
• Treat gateway budget_usd: 0 as a real zero cap; reject missing, negative, string, non-finite, and unsafe-size values instead of silently making an agent uncapped.
• Key dashboard SSE state by session so events cannot bleed across route changes without a synchronous effect reset; update the transitive DOMPurify fix.
• Refresh the live CLI journey so it uses a released oc, current starter input, and no unsupported repo source.

Deliberately unchanged

No W9/W10 implementation, per-agent egress policy, live-secret synchronization, staged tenant Worker, or other new product surface. This PR targets flue-native; it does not merge the evergreen.

Verification

• go test ./cmd/oc/internal/commands
• Flue SDK: test, typecheck, build, and npm publish --dry-run --json
• Packed 0.2.0 tarball installed into a fresh starter archive; typecheck and Cloudflare-target build passed
• Gateway: 37 tests + typecheck
• Log tail: 2 tests
• Dashboard: 8 tests, typecheck, production build, changed-page ESLint
• Dashboard and SDK production dependency audits: 0 vulnerabilities
• bash -n scripts/flue-journey.sh
• git diff --check

The repository-wide dashboard lint command still reports nine existing errors in files byte-identical to main; the only Flue-differing file it reported was SessionDetail.tsx, and that file is clean in this delta.

Release order

After this is folded into flue-native: merge the OpenComputer evergreen, wait for Publish Flue SDK, verify npm view @opencomputer/flue@0.2.0 version, then rerun the starter CI and merge the starter evergreen.